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Abstract 


In air traffic management systems, a conflict prevention system examines the traffic 
and provides ranges of guidance maneuvers that avoid conflicts. This guidance takes 
the form of ranges of track angles, vertical speeds, or ground speeds. These ranges 
may be assembled into prevention bands: maneuvers that should not be taken. Un- 
like conflict resolution systems, which presume that the aircraft already has a con- 
flict, conflict prevention systems show conflicts for all maneuvers. Without conflict 
prevention information, a pilot might perform a maneuver that causes a near-term 
conflict. Because near-term conflicts can lead to safety concerns, strong verification 
of correct operation is required. This paper presents a mathematical framework to 
analyze the correctness of algorithms that produce conflict prevention information. 
This paper examines multiple mathematical approaches: iterative, vector algebraic, 
and trigonometric. The correctness theories are structured first to analyze conflict 
prevention information for all aircraft. Next, these theories are augmented to con- 
sider aircraft which will create a conflict within a given lookahead time. Certain 
key functions for a candidate algorithm, which satisfy this mathematical basis are 
presented; however, the proof that a full algorithm using these functions completely 
satisfies the definition of safety is not provided. 


Acknowledgement: The author Cesar Munoz performed much of his contribution to 
this work as a staff scientist at the National Institute for Aerospace in Hampton, 
Virginia. 
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1 Introduction 


Many tools have been proposed to help aircraft maintain separation standards. At 
the lowest level, algorithms are developed that detect situations where separation 
standards will be violated in the near future (called a conflict). Once a conflict is 
detected, then a conflict resolution algorithm can be applied to create a new path in 
which there is no conflict. Both conflict detection and resolution algorithms usually 
work in a pair-wise fashion: the ownship aircraft and one other aircraft. In situations 
where traffic density is low, this pair-wise assumption does not significantly impact 
operations. However, when traffic density is high, resolving one conflict may result 
in new near-term conflicts — called secondary conflicts. These secondary conflicts 
may be nearer (in time) than the original conflict being addressed; so, the safety 
of the aircraft depends on avoiding these conflicts. More generally, any time an 
aircraft maneuvers there is the potential to create new conflicts, which must be 
avoided both for safety and efficiency. This conflict prevention information allows 
the pilot to perform conflict-free maneuvering. 

Avoiding potential conflicts involves analyzing possible maneuvers of the aircraft. 
There are two basic approaches to tactical 1 airborne conflict prevention: probing 
and bands. In the maneuver probing approach, the pilot or controller provides an 
individual maneuver, which is tested to ensure the proposed trajectory is conflict- 
free. In the bands approach, large groups of possible maneuvers are analyzed and 
the pilot is presented with ranges of track angles, ground speeds, or vertical speeds, 
which, if taken, will result in conflict-free trajectories. Alternatively, these ranges 
could represent avoidance or “don’t go” zones. These ranges of guidance maneu- 
vers are referred to as conflict-prevention information. This information may be 
used for probing, bands, or even future highly-automated approaches. The National 
Aerospace Laboratory (NLR) refers to their conflict prevention capability as Pre- 
dictive Airborne Separation Assurance System or Predictive AS AS [5]. The NLR 
approach provides two sets of bands: near-term conflicts (within 3 minutes) are 
shown in red, while intermediate-term conflicts (within 5 minutes) are shown in 
amber as illustrated in figure 1. We do not directly analyze the NLR system, but 
we do use it for the definition of the algorithm’s input and output and also as a 
prototype of a conflict prevention system’s behavior. 

Given the near-term nature of these conflicts, it is critical that systems pro- 
vide correct conflict-prevention information. The correctness of these solutions is 
established through a mathematical characterization and analysis of the conflict- 
free regions for vertical speed, ground speed and track angles changes. Most of the 
theory presented in this paper has been formalized and verified in the Prototype 
Verification System (PVS) [7]. We present the theorems and proofs in standard 
notation to make them accessible to a wider audience. The PVS theories and proofs 
are available at the web site. 2 

In addition to a general mathematical framework for the analysis of conflict 

x We use the term tactical to mean a system which only uses near-term predictions of aircraft 
behavior without incorporating pilot or controller intent. 

2 http : //research. nianet . org/fm-at-nia/ACCoRD/ 
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Figure 1. Compass Rose with Conflict Prevention Bands 


prevention information, we present candidate algorithms for vertical speed, ground 
speed, and track angle bands, along with preliminary mathematical analysis of these 
approaches. 

Although conflict-prevention systems have been used in several human-in-the- 
loop simulation experiments [1,2,6] and their functionality has been described in 
other papers [5,8], we believe this is the first published analysis of such information. 
The primary focus of this work has been conflict-prevention systems for airborne 
operation, but there is nothing inherent in this approach which precludes use in 
ground-based systems. 


2 Iterative Solution 

The formally- verified conflict detection and resolution algorithm KB3D [3] contains a 
conflict probe called CD3D (the CD3D algorithm is described in appendix A). Using 
this conflict probe, one can develop a simple iterative algorithm to compute preven- 
tion bands. For example, the track angle algorithm could be as shown in figure 2. 
Similar iterative algorithms could be developed for the vertical speed and ground 
speed guidance maneuvers. 

The CD3D algorithm has been formally proven correct and complete, i.e., the 
function CD3D returns the Boolean value TRUE if and only if there is a predicted loss 
of separation. However, the correctness and completeness of CD3D does not imply 
the correctness nor the completeness of this simple iterative algorithm. Indeed, for 
any given step size, there are track angles that should be colored red or yellow that 
are missed. Conversely, not all the angles in a red or yellow band necessarily indicate 
a predicted loss of separation. To minimize this problem, the track step may be set 
to a very small angle. However, in that case, the efficiency of the algorithm suffers 
due to the large number of points to be checked. For these reasons, we seek an 
analytical approach that precisely computes the complete set of preventions bands. 
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input: ownship state, 

list of traffic aircraft, 
minimum horizontal separation D, 
minimum vertical separation H, 
track discretization step 

Track = 0; 

while Track < 360 do 
DisplayColor = green 

NewOwnship. position = Ownship. position 

NewOwnship. velocity = compute new velocity vector which has 

the magnitude of ‘ Ownship. velocity * and 
points in the direction of ‘Track* 

for each traffic aircraft. Traffic: 

RelativePosition = NewOwnship .position - Traffic .position 
RelativeVelocity = NewOwnship .velocity - Traff ic . velocity 

if CD3D (RelativePosition, RelativeVelocity, D, H, 3) 
then DisplayColor = red 

else if CD3D (RelativePosition, RelativeVelocity, D, H, 5) 
then DisplayColor = amber 
end if 

draw point on compass at angle ‘Track* with color ‘DisplayColor* 
Track = Track + step 
end while 


Figure 2. Track Angle Iterative Algorithm 
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3 Problem Assessment 


Each aircraft’s contribution to the prevention band is independent of all other traffic; 
thus, the problem neatly divides into a series of aircraft pairs: the ownship and each 
traffic aircraft. The conflict-free regions for each aircraft may then be merged into 
an overall picture of the airspace around the ownship. Analysis of the algorithm to 
merge bands is left for future work. 

3.1 Modeling Considerations 

Throughout this paper, we use the following notation to represent the pair of aircraft. 


So 

3D vector 

initial position of the ownship aircraft 

V 0 

3D vector 

initial velocity of the ownship aircraft 

Si 

3D vector 

initial position of the traffic aircraft 

Vi 

3D vector 

initial velocity of the traffic aircraft 


The components of each vector are scalar values, so they are represented without the 
bold- face font, for example s G = ( s ox , s 0 y> s oz )■ As typical of state-based approaches, 
speeds are presumed to be ground-relative. The use of ground speed was chosen 
to correspond to position and velocity reports coming from Automated Dependent 
Surveillance (ADS-B) systems. The impact of differences between ground speed and 
air speed is left for future work. As a simplifying assumption, we regard the position 
and velocity vectors as accurate and without error. For notational convenience, we 
use v 2 = v • v. 

In the airspace system, the separation criteria are specified as a minimum hori- 
zontal separation D and a minimum vertical separation H (in much of the airspace 
D is 5 nautical miles and H is 1000 feet). It is convenient to develop the theory using 
a translated coordinate system. The relative position s is defined to be s = s G — Si 
and relative velocity of the ownship with respect to the traffic aircraft is denoted 
by v. With these vectors the traffic aircraft is at the center of the coordinate sys- 
tem and does not move. For example in figure 3, the blue (upper) dot represents 
the ownship with its velocity vector and the magenta vector (lower) is the velocity 
vector of the traffic. In the translated coordinate system, these vectors combine to 
form a single relative vector, also shown in blue in figure 3. The separation criteria 
defines a cylinder of radius D and half-height H around the traffic aircraft. This 
cylinder is called the protected zone. 

In figure 3, the green vectors show possible resolution vectors. In this figure, 
there is a horizontal conflict because the relative velocity vector (blue) defines a 
half-line that intersects the protected zone, meaning that in some future time the 
ownship will enter the protected zone around the traffic. More formally, a horizontal 
conflict occurs if there exists a future time t where the aircraft positions s 0 + tv 0 and 
Sj + tv* are within a horizontal distance D of each other. In the relative coordinate 
system, we define 

Definition 3.1 (horizontal conflict?). 

horizontal conf lict?(s, v) = 3 1 > 0 : (s + tv) 2 < D 2 , (1) 
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Figure 3. Translated Coordinate System 


where s and v are, respectively, the projections on the horizontal plane of the relative 
position and velocity vectors of the ownship with respect to the traffic. 

In this definition, we model future aircraft positions as a linear projection of 
the aircraft’s velocity from its current position. An aircraft’s acceleration — both 
positional and angular — are not modeled. It is easy to show that horizontal_ 
conflict? precisely defines a minimum separation D between the points s G + tv Q 
and s i + tVi : 

\J ((^oas T Voxt) T ^ix^)P T ((^oy T Voy^) iy T Vi y^)) 2 ^ D 

( S X + V x t)^ + ( Sy + Vyt < iP 

(s + tv) 2 < D 2 . 

A vertical conflict occurs if there exists a future time t where the aircraft are 
within distance H of each other, i.e., 

1(^02 T tVoz} (Siz T tViz ) | ^ H' 


Two aircraft are in a conflict if there exists a future time t where the two air- 
craft have both horizontal and vertical conflicts — that is, there is a predicted loss of 
separation. 

3.2 Lookahead Time 

If an aircraft restricts its movement based on all aircraft within its ADS-B range, 
then many relatively safe maneuvers will be unnecessarily avoided. 3 Instead, only 
those aircraft that will cause near-term conflicts should be included in the compu- 
tation of conflict prevention information. 

We follow the approach from Predictive ASAS [5] by introducing two parameters, 
T re d and T am & er , which divide the set of conflicts based on their nearness (in time) to 
a loss of separation. The Predictive ASAS uses 3 minutes for T re( i and 5 minutes for 
Tamber 5 our analysis leaves these as parameters. From a prevention band approach, 
if a loss of separation will occur within T re ^, then the region is colored red. On 

3 ADS-B range over the ocean may reach 200 nautical miles. 
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the other hand, if a loss of separation will occur after T re ^, but before T am & er , then 
the region is colored amber, otherwise it is painted green. Since T re ^ < T am & er , the 
boundaries for a guidance maneuver (ranges of track angles, etc.) for a conflict that 
is within T rei d are completely contained within the boundaries for a conflict that is 
within T am & er . With this observation, the majority of the analysis can use a single 
lookahead time T, and T rec i and T am & er can be accounted for by their relationship. 

When we consider the lookahead time we notice that there are three distinct 
cases, as illustrated in figure 4. In figure 4a, all points in the protected zone can be 




Figure 4. Relationship of Encounter Geometry and Lookahead Time 

reached within the lookahead time. In this case the lookahead time does not enter 
into the analysis, so the aircrafts’ encounter geometry can be evaluated without 
regard to a lookahead time. In figure 4c, where no point in the protected zone can 
be reached within the lookahead time, this conflict is too far away to be considered, 
so it does not restrict the ownship’s maneuvers — essentially the traffic is ignored. 
It is only in figure 4b, where some points in the protected zone may be reached 
within the lookahead time, that lookahead time considerations must be addressed. 
We label situations like figure 4a as encounter geometry cases. We label the cases 
of figure 4b as lookahead time cases. The lookahead time cases involve analysis of 
both geometric and time considerations. Although the principle illustrated by this 
figure still holds, the protected zone is not an arbitrary regular polygon; rather, it is 
a rectangle for vertical speed maneuvers (incorporating the horizontal and vertical 
distance between the two aircraft) or a circle for both track angle and ground speed 
maneuvers (incorporating both horizontal dimensions). 

4 Vertical Speed Prevention Bands 

A vertical speed prevention band algorithm determines those vertical speeds that 
will result in a conflict with another aircraft. The algorithm can be used to paint 
a display similar to figure 5: the red region indicates those vertical speeds that will 
result in a conflict, while green indicates speeds that will not cause a conflict within 
the lookahead time. 

It is assumed that the aircraft’s track angle and ground speed remain unchanged 
while the vertical speed is varied. Consequently, if the current horizontal velocity 
does not have a horizontal conflict, then the solution is trivial, i.e., the region is 
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Figure 5. Vertical Speed Bands 


green for all vertical speeds. When the current track does have a horizontal conflict 
then we are faced with the situation shown in figure 6. In this translated frame 
of reference the traffic aircraft is centered in the coordinate system with a vertical 
protected zone from — H to +H. In this figure there are several relative velocity 
vectors are shown, some in conflict (red) and some that are not (green). 

Computing conflict prevention bands involves whole ranges of vertical speeds. 
Figure 6 illustrates the problem. In this figure, the horizontal dimension represents 
along track distance between the two aircraft and the vertical dimension represents 
vertical distance between the two aircraft. The blue dot represents the position of 
the ownship and the the magenta dot represents the position of the traffic. The 
arrows represent potential velocity vectors for the ownship (varying the vertical 
speed). The red vectors indicate velocities where the protected zone is violated and 
the green vectors indicate conflict-free trajectories. Instead of computing individual 
trajectories, we want to analytically determine which vectors are green and which 
are red as the vertical speed is varied. In this figure the two relative velocity vec- 
tors Vi and V 2 are the vectors that sit at the transition point between colors. If 
we can compute these, then we can accurately paint the vertical speed prevention 
band. Recognizing that vertical speed cannot be unlimited, the trajectory with the 
maximum vertical speed is indicated with max_vs and the vector with the minimum 
vertical speed is indicated by -max_vs.. 

4.1 Encounter Geometry Analysis 

To determine the transition vectors for the encounter geometry, we consider four 
cases of the two aircraft. Examples of these four cases are shown in figure 7. These 
four cases correspond to: (a) no horizontal conflict, (b) vertical loss of separation, 
i.e., —H < s z < H, but not a horizontal loss of separation, i.e., s* + Sy > D 2 , (c) 
a horizontal loss of separation, but not a vertical loss of separation, and (d) neither 
vertical nor horizontal loss of separation. These cases are exhaustive because, by 
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Figure 6. Vertical Speed Trajectories 


(a) 




Figure 7. Vertical Encounter Geometries 
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assumption, we are excluding the case where there is a loss of separation both 
vertically and horizontally. The first case is trivial since all vertical speeds avoid 
conflicts and therefore none need to be prevented. The other three cases rely on 
the time to enter or exit the protected zone horizontally. To find these times, 
we perform a linear prediction of the relative position of the two aircraft into the 
future. We know the protected zone is entered when this position equals 75, that is, 
an equation representing the intersection of a trajectory with a circular protected 
zone. Mathematically, we solve the following equation for t : 

||s + £v|| = D, (2) 

where, for this derivation, s and v are two dimensional vectors. This equation 
expands to 

(s + tv) 2 = D 2 , 


which further expands to 


t 2 v 2 + 2t(s ■ v) + s 2 - D 2 = 0. (3) 

This equation is a quadratic in t , with 

a = v 2 , b = s-v, c = s 2 — 75 2 . 


The roots of this equation give us the entry and exit times into the protected zone. 
These are named 0(s,v, — 1) and 0(s, v,+l), respectively: 


0(s,v,-l) 

0(s,v,+l) 


—b — V& 2 “ CLC 
a 

—b + y/b 2 — ac 


a 


( 4 ) 

( 5 ) 


Where it is unambiguous, we will abbreviate these as 0_ and 0+. If the relative 
ground speed is 0, i.e., v = 0, then 0± is undefined, which corresponds to the first 
case (no horizontal conflict), unless the two aircraft are not horizontally separated. 


4.1.1 Vertical Loss of Separation 

The situation where there is vertical loss of separation but not a horizontal loss 
of separation (the second case, mentioned above) can be solved by computing the 
vertical speed required to enter the protected zone (that is, when the time is 0_) at 
its top and bottom edges. These two speeds can be represented with the introduction 
of a parameter e, which is defined as 


e — +1 

top of the vertical protected zone 

6 = — 1 

bottom of the vertical protected zone 
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Using e the top and bottom edges can be represented as eH. The vertical speed is 
computed with the following derivation. 

s z + v z Q- = 
v z @~ = 

V z = 

Voz Viz = 

Voz ~ 

The right side of this equation is called vertical_THETAl(s, v G , v*, e). We name the 
solutions from this function as follows 

Virn = vertical_THETAl(s, v G , v*,— 1), 

Vi p = vertical_THETAl(s, v G , v$,+l), 

where s, v G , are three dimensional vectors. The vertical bands should be colored 
as follows for an arbitrary vertical speed v oz : 


-max_vs < v oz < V lm 

green 

Vim ^ V oz < V\ p 

red 

Vi p < v oz < max_vs 

green 


where max_vs is the maximum vertical speed. 

4.1.2 Horizontal Loss of Separation 

The third subcase occurs when s 2 < D 2 . In this case, we are interested in the time 
to exit the horizontal protected zone. If the aircraft is below the protected zone, 
then we must go no higher than — H vertically. On the other hand, if the aircraft is 
above the protected zone, we must go no lower than +H. Both of these destinations 
can be captured by the formula slgn(s z )H. To compute the vertical speed we use 
the derivation 


eH , 

eH - s z , 
eH -s z 
©_ 5 
eH -s z 


0- 


Viz + 


eH 


0_ 


s z H~ v z ®+ 
v z 9+ 

V z 

Voz Vi z 
Vqz 


sign (s z )H, 
sign (s z )H - s z , 
sign(s z )H - s z 
©+ 

sign(s z )H - s z 

0 + 

sig n(s z )H - s z 


The right side of the last equation is called vertical_THETA2(s, v 0 , v*), which we 
abbreviate as V 2 . The regions are colored as follows: 


10 


«*>0 

8,<0 

-max_vs < v oz < V 2 

red 

-max_vs < v oz < V 2 

green 

V 2 < v oz < max_vs 

green 

V 2 < v oz < max_vs 

red 


4.1.3 No Loss of Separation 

The fourth case is a combination of the equations developed in the two previous 
cases. The regions are colored as follows 


a*>0 


s z 0 

-max_vs < v oz < V lm 

green 

-max_vs < v oz < V 2 

Vl m ^ V oz < V2 

red 


V 2 < v oz < max_vs 

green 

Vlp < u oz < max_vs 


4.1.4 Algorithm for Encounter Geometry 


To develop an algorithm to compute the vertical speed bands, we must combine 
the four cases into a single solution. But a simple observation suggests a simple 
algorithm. We notice that there are only a small number of critical points where 
the vertical bands may change colors: Vi m , V\ p and V 2 . We observe that if we 
evaluate the conflict status around these points, then we can characterize the whole 
range of vertical speeds. The computation of these three points can be combined 
into a single function: 

vertical speed circle(s, v G , v^, e) = 

IF (Vqx V ix ) T ( V Q y V iy ) = 0 THEN 
(Voxi V 0 yi Viz) 

ELSIF es z < H AND s 2 x + > D 2 THEN 

( Vox , v oy , vertical _THETAl(s, v G , v*, e)) 

ELSIF es z > H THEN 

( Vox , v oy , vertical _THETA2(s, v G , v*)) 

ELSE 

( 0 , 0 , 0 ) 

ENDIF 


where 


and 


/ x eiT — s z 

vertical_THETAl(s, v G , Vj, e) = v% z + 


vertical_THETA2(s, v 0 , Vj) = Vi z + 


@_ 

s±gn(s z )H - s z 
0 + 


Due to geometric limitations all three points are never needed; instead, at most, two 
are required: 


Z m = vertical_speed_circle(s, v G , Vj, — 1) 
Z p = vertical_speed_circle(s, v G , v*, +1) 
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We use the z component of these vectors and add the minimum (-max_vs) and 
maximum (+max_vs) vertical speeds to a list of four values. If we sort this list, we 
end up with four ascending values: 

Vo < ^1 < ^2 < ^3 

Usually Vo is the minimum vertical speed and v% is the maximum vertical speed; 
however, this is not required. These four values correspond to three possible regions 
and the color of these regions can be determined using a conflict probe like CD3D 
(see appendix A). 


Uo to V\ 

cd3d( vo + t ’ 1 ) 

Vi to V 2 

cdSdf 1 ^) 

V2 tO V% 

cd3d(Mi) ' 


4.2 Lookahead Time Analysis 

As introduced in section 3.2, we use the two lookahead times representing near-term 
conflicts (T re d) and mid-term conflicts (T am fc er ). We first consider a single lookahead 
time (T), then later add the second time. 

In the finite lookahead problem, we adjust the limits of the vertical speed based 
on the relationship between the lookahead time and the time to enter or exit the 
protected zone horizontally (0±). Comparing the lookahead to the entry and exit 
times results in three cases: 


• Lookahead time is before the entry time (T < 0_). 

• Lookahead time is between the entry and exit times (©_ < T < ©+). 

• Lookahead time is after the exit time ( 0+ < T). 

These cases correspond to situations where all points within the protected zone can 
reached within the lookahead time, some points can be reached within the lookahead 
time, and no point may be reached within the lookahead time. The first and third 
cases are elementary. In the first case, no vertical speeds are prevented and in the 
third case, the results from the encounter geometry solution can be used. The second 
case (figure 8) requires additional analysis. In this illustration, the horizontal axis 
represents time rather than distance. Here the lookahead time falls between the 
entry and exit times. The vector v is drawn at the point where T is the entry point 
into the protected zone. Following a development similar to vertical_THETA2, this 
vector is computed by 


s z + v z T 
v z T 

v z 

Voz Vi z 
Vqz 


eH, 


eH - s z , 
eH - s z 

T ’ 
eH - s z 


T 


Viz “t - 


tH - Sz 

T 
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Figure 8. Vertical Speed Range with Lookahead Time 

Since we are excluding the case where T > 0+, we can combine this with the 
previous definition of vertical_THETA2 to get a single expression 

vertical_THETA2(s, v 0 , Vj, T) = v iz + - ^ { * z ) H ~ Sz . ( 6 ) 

With this new definition, the functions vertical_THETA2 and vertical_speed_circle 
can be extended with a lookahead time. 

4.3 Algorithm for Lookahead Time 

We first generalize vertical_speed_circle to include the lookahead parameter as 
follows: 

vertical _speed_circle(s, v 0 , v$, T, e) = 

IF ( Vox V ix ) T ( V Q y V%y) = ^ THEN 

(^ 0 x 5 Voy? Viz) 

ELSIF es z <H AND s 2 x + s 2 y > D 2 THEN 
(Vox, v oy , vertical_THETAl(s, v G , v*, e)) 

ELSIF es z > H THEN 

(v ox , v oy , vertical_THETA2(s, v 0 , v*, T )) 

ELSE 

( 0 , 0 , 0 ) 

END IF 

where vertical_THETA2 is defined by (6). We instantiate this function using T re d 
and T am & er yielding four possible values 

^rm — vertical speed circle(s ? 1 ) 

Z rp = vertical_speed_circle(s, v 0 , Vj, T re( i, +1) 

Zom = vertical_speed_circle(s, v G , Vj, T amber , -1) 

Z ap = vertical_speed_circle(s, v 0 , Vj, T amber , +1) 
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Once again we use the z component of these vectors and add the minimum and 
maximum vertical speed to create a list of six values. If we sort this list, we end up 
with six ascending values: < v\ < V 2 < < v$. These six values correspond 

to five possible regions, where the color can be determined using a conflict probe 
like CD3D (see appendix A). 


Uo to V\ 

cd3d{ vo + vl ) 

Vl to V2 

cd3d(**p) 

V 2 tO V 3 

cd3d(Mi) ' 

Vs to V 4 

cd3d( W3 + W3 ) 

V 4 tO U5 

cd3d(M&) 


5 Horizontal Considerations 

Both the ground speed and track prevention bands are horizontal problems. Similar 
to the vertical case, if there is not a vertical conflict, then all ground speeds and 
track angles should be allowed. So we implicitly consider only those cases where 
there is already a vertical conflict. For the ground speed prevention band, we vary 
the ground speed of the ownship and determine those ground speeds leading to a 
conflict. We denote the ownship velocity vector with ground speed k as 

V K — Tj jT ( Vox-) Voy)- (7) 

I I V o | | 

For the track prevention bands, we vary the track angle of the ownship velocity and 
determine those track angles leading to a conflict. We denote the ownship velocity 
vector with track a as 

v a = (o;cosQ, casino;), (8) 

where u is constrained by u 2 = v 2 x + v 2 y . In both of these definitions, the vertical 
speed is unchanged. 

In both cases, the boundaries are determined by the vectors that are tangent to 
the protected zone in the relative frame of reference. The next two sections involve 
developing forms to express and compute these tangents. Both cases deal primarily 
in the horizontal dimensions; so, the vectors in this section are the two dimensional 
versions of the vectors presented in section 3.1. Both v K and v a may be extended 
to three dimensional vectors by including the original vertical speed: (v KXl v Kyi v oz ) 

or {Volx-) Vay-) ^oz)- 

5.1 Tangent Condition 

We begin by examining the necessary conditions to ensure a relative velocity vector 
v is tangent to the protected zone. One condition on the vector v is that, there 
must exist some time t that results in a position at the edge of the protected zone. 
We start with (2) and follow the same derivation to the quadratic (3). The roots of 
this equation give us the entry and exit times into the protected zone, which were 
previously labeled as 0_ in (4) and 0+ in (5). Equation (3) provides the general 
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solution for the intersection of a trajectory and the protected zone. To find the 
resolution trajectory, we must constrain v to only those velocity vectors that are 
tangent to the protected zone. This will occur when the entrance and exit times 
to the protected zone are equal, 0_ = 0+. These times will be equal when the 
discriminant of (3) is zero, that is, 

(s.v) 2 -v 2 [s 2 -D 2 } = 0. (9) 


During the development of KB3D several simplifications to the discriminant were 
discovered. The key to these simplifications is the lemma sq_det: 

Lemma 5.1 (sq det). 


(s • v) 2 = v 2 s 2 — det(s, v) 2 , 
where, det(s, v) = s 1- • v and s -1 = (— s y , s x ). 
Proof. Algebraic simplification, which establishes 


s 2 x vl+2s x v x syv y + s 2 y v 2 y 


2 2 , 
^x^x ~f" 

2 r>2 


2 2 
~ s x v y 


4 v l + ~ s y v y + vZL>Z 


rt 2 2 


,2 n2 


(S X Vy -SyV X ) 2 + V 2 D 2 . 


( 10 ) 

(ii) 


□ 


Using the sq_det lemma twice, (9) can be simplified as follows 


(s • v) 2 — v 2 [s 2 — D 2 ] 
v 2 s 2 - det(s, v) 2 - v 2 [s 2 - D 2 ] 
— det(s, v) 2 + D 2 v 2 

D 2 \ 2 

D 2 \ 2 s 2 - -D 2 det(s, v) 2 
D 2 [v 2 s 2 — det(s, v) 2 ] 
D 2 (s ■ v) 2 
(s • v) 2 

I s ‘ v l 

S • V 


0, 

0, 

0, 

det(s, v) 2 , 

det(s, v) 2 s 2 — D 2 det(s, v) 2 , 
det(s, v) 2 [s 2 — D 2 ], 
det(s, v) 2 [s 2 — D 2 ], 

R 2 det(s, v) 2 , 
i?|det(s, v)|, 
i?edet(s, v), 


where e € {— 1, +1} and 


R 


Vs 2 — -D 2 

D 


( 12 ) 


(13) 


Any s and v vector that satisfies (12) forms a trajectory that is tangent to the 
protected zone. This remarkably succinct result factors out the squared terms of (9) 
into a linear expression using a simple signed variable e. Formula (12) efficiently 
defines tangent vectors but it does not filter out tangents that have occurred in the 
past, i.e., that point away from the protected zone. To perform this filtering, we 
rely on the following lemma to find the time of closest approach. 
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Lemma 5.2 (closest_approach). The minimal separation occurs at time r, where 


Proof. The distance between the aircraft d(t) = ||s + fv|| achieves a minimum when 

d 2 {t) — (s + £v) 2 

= s 2 + 2£(s * v) + t 2 w 2 . 

achieves a minimum. Since this distance function has no maximum (at infinite time, 
the distance is infinite), the minimum occurs when the derivative of d 2 (t) equals zero: 

2(s • v) + 2tv 2 = 0. 


Solving for t we have 


t 


s - v 


V 


2 ' 


□ 

Therefore s * v is negative if the tangent occurs in the future. We now define a 
predicate that defines tangents that are towards the protected zone: 

Definition 5.3 (line solution?). 

line solution?(s, v, e) = i?edet(s, v) = s • v AND edet(s,v)<0. (15) 
It is easy to see that line_solution?(s, v, e) implies that s • v < 0. 


5.2 Computing Tangents 

In this section we develop a simple way to find a point Q on the line from s that is 
tangent to the protected zone. An important aspect of the definition of Q is that 
it is only determined by the geometry of the encounter — the aircraft velocities are 
not involved. We restrict our attention to situations where there has not yet been 
a loss of separation, i.e., s 2 — D 2 > 0. We define two auxiliary functions &(s) and 
j3( s) as follows: 

a(s) 

s) 

where, R is defined as in (13). We will abbreviate these values as a and /3 when it is 
clear. The following equation is a simple algebraic consequence of these definitions 


k 


D 2 


s 2 - -D 2 


= Ra( s), 



a- 1 
R 


(16) 
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We then define the components of Q(s, e) as follows 

Qx{ s,e) = d(s) s x + e/3(s) s y , 

Qy{ S, e) = d(s) Sy - e/3(s) 

The vector Q(s, e) — s is the desired tangent vector. 

We would also like to compute a suitable tangent for the special case where 
s 2 = D 2 . In this case, an appropriate vector is the perpendicular vector. We define 
the function tangent.line in figure 9 to capture this special case. We now define 



Figure 9. Tangent Vector Computation 
a predicate tangent_line? to represent the set of all tangent velocity vectors: 

Definition 5.4 (tangent line?). 

tangent_line?(s, v, e) = 3 k >0 : v = k tangent _line(s, e) (17) 

Next we will show that all of these vectors satisfy line_solution? and hence are 
tangent to the protected zone. 

Theorem 5.5 (tangent_line_solution). 

tangent_line?(s, v, e) line_solution?(s, v, e). 

Proof. The s 2 = D 2 case is trivial, so we focus on the cases where s 2 > D 2 . First we 
prove tangent_line?(s, v, e) => line_solution?(s, v, e). Since v = fc[Q(s,e) — 
s], we can use many algebraic simplifications and (16) to obtain 

s • v = s* k( Q — s) 

= k (a — l)s 2 
= k(-pR)s 2 
= i?e(s J_ • k(Q — s)) 

= Re (s x • v) 

= i?edet(s,v). 


17 




Also, we need to show that edet(s, v) < 0. Since (3 > 0 we have —/3s 2 < 0. The 
following algebraic manipulation 

-/3s 2 < o <=> e(— e/3s 2 ) < 0 

•<=>• e [s -1 ■ (Q — s)] < 0 

-<=>- e (s -1 ■ v) < 0 

-<=>- edet(s, v) < 0 
s ■ v 

<=*■ £ -r 5a 

establishes the needed result. 

Now we prove that line_solution?(s, v,e) => tangent_line?(s, v, e). We 
could prove that v is a multiple of Q(s, e) — s, or more succinctly, we could prove 
that v and QM — s are parallel. To show that two vectors are parallel it is 
sufficient to show that their 2-dimensional determinant (11) is zero. So we will 
show that det(v, Q — s) = 0, which is equivalent to det(v, Q) = det(v, s), since 
det(v, Q — s) = det(v, Q) — det(v, s). Thus, 

det(v, Q) = v x * Q 

= VxQy VyQx 

= [a Sy C (3 5^] Vy [o S x T C [3 Sy] 

= d^v -1 • s) — e/3( s • v). 

Using (16) and line_solution?, we further simplify: 

a (v -1 • s) — e/3(s * v) = a^v 1 - • s) + e — ^ (s • v) 

it 

= d^v -1 • s) + (d — l)(s J_ * v) 

= a^v 1 - • s) — (d — lXv -1 * s) 

= v ± .s 


= det(v,s). 


n 

This ends the groundwork for computing tangents in the horizontal plane. These 
results will be used to find the prevention bands for ranges of either ground speeds 
or track angles. 

5.3 A Simple Formula for Horizontal Conflict 

It is necessary for us to detect whether a given vector is in horizontal conflict (1). 
The following theorem provides the needed relationship between horizontal conflict 
and a simple formula that does not include a quantification over time. Instead, 
this theorem provides an equivalence between horizontal_conf lict?(s , v) and 
the conjunction of two simple inequalities. 
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Theorem 5.6 (horizontal_solution). 


horizontal conflict?(s, v) s * v < i?det(v, s) < — s • v, 

where, R is defined as in (13). 

Proof We note that another way to describe horizontal_conf lict? is as a trajec- 
tory, which points towards the protected zone. Any trajectory that points towards 
the protected zone (and has not already entered the protected zone) will have entry 
and exit times into the protected zone — called 0_ and ©+. These times are only 
defined when the discriminant of the quadratic (9) is greater than zero. 

Now, we show that when the discriminate is greater than zero, then certain 
inequalities are satisfied. We follow a derivation similar to the development of (12). 

(s-v) 2 -v 2 (s 2 - D 2 ) > 0, 

(s-v) 2 > v 2 (s 2 — D 2 ), 

v 2 s 2 - det(v, s) 2 > v 2 (s 2 - D 2 ), 

D 2 v 2 > det(v, s) 2 , 

D 2 v 2 s 2 — D 2 det(v, s) 2 > det(v, s) 2 s 2 — D 2 det(v , s) 2 , 

D 2 [v 2 s 2 — det(v, s) 2 ] > det(v, s) 2 [s 2 — D 2 ], 

D 2 (s • v) 2 > det (v, s) 2 [s 2 — D 2 ] , 

/ x 2 , , 2 S 2 -£> 2 

(s-v) > det(v, s) d2 , 

(s-v) 2 > R 2 det(v, s) 2 , 

|s - v| > R |det(v, s)|, 

which can be expanded into the following conjunction of inequalities 

— |s • v| < i?det(v,s) < |s • v|. 

The initial situation is in horizontal_conf lict?, so s • v must be less than 0, thus 

s • v < i?det(v,s) < — s • v. 

The proof steps can be reversed to obtain the implication in the other direction. □ 
It is convenient to define 

horizontal_criterion?(s, v, e) = s * v > i?edet(v,s). 

Using this definition we immediately obtain: 

Theorem 5.7 (horizontal criterion independence). 

NOT horizontal conf lict?(s, v) 

horizontal criterion? (s, v, —1) OR 
horizontal criterion?(s, v, +1). 
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6 Ground Speed Prevention Bands 


A ground speed prevention band algorithm calculates the ground speeds of the 
ownship aircraft which will result in a conflict with another aircraft. Figure 10 gives 



ground speed 
(knots) 


Figure 10. Ground Speed Prevention Bands 

an example display of ground speed prevention information. As described earlier, 
we use two parameters to represent the lookahead times (T re d? ^am&er) that are 
used to filter conflicts that are too far in the future. The red region in figure 10 
indicates which ground speeds will result in a loss of separation within T re ^ while 
green indicates ground speeds that will not result in a loss of separation before 
T amber- The bands algorithm varies the ground speed while holding vertical speed 
and track angle constant. For some ground speed the aircraft will be in conflict 
with the traffic and for other values it will not be, as illustrated in figure 11. One 
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Figure 11. Ground Speed Trajectories 

may recall that a change in the ownship’s ground speed often results in a change in 
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the direction of the velocity vector in the relative frame of reference. The transition 
from green to red and vice versa occurs at the tangent vectors. 

6.1 Encounter Geometry Analysis 

Using the Q theory developed in section 5.2, we need to find a k such that 

Av 0 — v* = k tangent _ line (s, e), (18) 

where Av 0 represents a change to (only) the ground speed of the ownship’s veloc- 
ity. Recall that tangent_line (figure 9) returns a vector that is tangent to the 
protected zone. Therefore, (18) represents a change to the ownship’s ground speed, 
which results in a relative velocity vector that is tangent to the protected zone. We 
now wish to find a way to calculate k and A assuming the term tangent_line is 
represented as v. 

Lemma 6.1 (k l det). 

kv + Vi = Av 0 

A:det(v 0 , v) = det(v*, v Q ) AND Adet(v 0 , v) = det(v^, v). 

Proof. The components of kv + v* = Av 0 are 

kv x T Vix = 

kvy T v%y — A V Q y. 

Multiplying both side with v oy and v ox , we obtain: 

kv x V Q y T Vix^oy = A V ox V Q y. 

kVyV 0 x T ^iy^ox = ^Voy^ox' 

Subtracting gives us: 


k(v x V oy VyVox ) T VixVoy ^iy^ox — 6? 


or 

k det(v, v G ) = det (v Q , v*), 

which is equivalent to 

k det(v 0 , v) = det(v*, v G ). 

Using a similar derivation, yields the following relationship for A: 

Adet(v 0 ,v) = det(v*, v). 


□ 
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gs_line_eps(s,v 0 ,v i 5 e) = 

v — tangent _line(s, e) 
IF det(v G , v) 7 ^ 0 THEN 
k= det (v^v 0 ) 
det(v G , v) 

A= det(v^v) 
det(v G , v) 

IF A > 0 THEN 
A v G 
ELSE 
( 0 , 0 ) 

END IF 
ELSE 
( 0 , 0 ) 

ENDIF 


Figure 12. Ground Speed Scale Factor Computation 


Therefore, if we instantiate v in this lemma with a known tangent vector — that is, 
the result from tangent_line in figure 9 — we have the needed k that satisfies (18). 
With this result we can compute the tangent vector with the function gs_line_eps 
(figure 12 ). Note that if det(v G , v) = 0, then there is no ground speed change in the 
direction of v G that produces a tangent. The A > 0 test eliminates solutions that 
are in the opposite direction. 

Using the definition of gs_line_eps in figure 12 we obtain two potential bound- 
ary ground speeds: 


G m = ||gs_line_eps(s, v 0 , Vj,-l)||, 

G p = ||gs_line_eps(s, v 0 , Vj, 1)||. 

Either of these speeds may be undefined, that is, the gs_line_eps function returns 
a zero vector. If G m is undefined, we set it to 0. If G p is undefined, we set it equal 
to max_gs, the maximum ground speed to be displayed. With the definition of these 
two speeds, the display can be painted as follows: 


QS ^ G m 

green 

G m ^ ^ Gp 

red 

G p ^ QS 

green 
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6.2 Lookahead Time Analysis 

We now incorporate a finite lookahead time into the analysis of ground speed bands. 
Using the general outline from section 3.2, if the entire protected zone is inside 
the lookahead time, then the bands are easily computed using the technique from 
section 6.1. However, special techniques must be used if the lookahead time crosses 
the protected zone as show in figure 13. We must calculate the intersection of the 

/ T 

t Lookahead Time 

/ 



Figure 13. Ground Speed Trajectories with Lookahead Time 

protected zone with the lookahead time. The relative velocity for a ground speed 
change is given by v = Av 0 + v^, where A is a factor to adjust the ownship’s ground 
speed and equals , which is consistent with (7). To find the point where this 
velocity intersects the protected zone, we need to find a A such that ||s + Tv|| = D, 
where T is the lookahead time. 

||s + vT|| = D 

(s + vT) 2 = D 2 

(s + (Av 0 - Vj)T ) 2 = D 2 


If we let W = s — Tv*, then 

(W + A v 0 T) 2 = D 2 

(W + A v 0 T) • (W + A v 0 T) = D 2 

Expanding we obtain a quadratic equation in A with 

a = T 2 v 2 , b = 2T (W • v 0 ), c=W 2 -D 2 . 

When the discriminant is greater than or equal to zero, then the intersection between 
the circle and the lookahead time exists. We only want solutions where A > 0. The 
function gs.circle (figure 14) solves this quadratic and returns a nonzero vector 
when an intersection point exists. 
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gs_circle(s, v G , v*, t , irt) = 

W = s — t v i 

,2 2 

a = t v G 

6 = 2t (W * v 0 ) 

c = W 2 - T> 2 

IF discr(a, b, c) > 0 THEN 
A = root(a, b, c, irt) 

IF A > 0 THEN 
A v G 
ELSE 
( 0 , 0 ) 

ENDIF 

ELSE 

( 0 , 0 ) 

ENDIF 


Figure 14. Ground Speed Circle Algorithm 


6.3 Vertical Considerations 

Up to this point we have ignored the impact of the aircraft’s vertical speed. If 
the aircraft are in conflict horizontally but not vertically for a particular ground 
speed, then that ground speed should be allowed. Only if there is both horizontal 
and vertical conflict should that ground speed be prevented (i.e., painted red). For 
example, the aircraft could be vertically and horizontally separated, but the loss of 
separation occurs once the vertical standard is violated, as illustrated in figure 15. 
In this case the time to enter vertically is critical to the solution. Alternately, we 




Figure 15. Vertical Entry Time Considerations 
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could have the same situation horizontally, but due to different vertical constraints, 
there is no conflict, as illustrated in figure 16. In this case, the time to exit vertically 
is important. 



Figure 16. Vertical Exit Time Considerations 


To address these situations, we must calculate the time to enter and exit the 
protected zone vertically: 


t 


entry 


i'exit 


— sig n(v z )H-s z 

V z 

sign (v z )H - Sz 
Vz 


(19) 

( 20 ) 


Even though the aircraft are currently vertically separated they will lose vertical 
separation after t en t ry . Consequently, the vectors that intersect the circle at these 
vertical entry points are velocity vectors where separation may be lost. If the aircraft 
are currently not vertically separated, they may become separated at time t ex it. 
Therefore, the velocity vectors that intersect the circle at these vertical exit points 
may be vectors where separation is regained. 

The ground speeds that corresponds to these times may be found using the 
Ground Speed Circle algorithm (figure 14) with t entry / exit for the time parameter. 
In some cases these times may be negative, meaning the aircraft has already entered 
the vertical protected zone or that the aircraft will never enter the protected zone 
vertically. In these cases, a constraint on the entry/exit time is ignored. Likewise, if 
the vertical speed (v z ) is zero, then these times are undefined and the corresponding 
constraint is ignored. 


6.4 Sketch of a Ground Speed Algorithm 

The basic idea of a ground speed algorithm is to create a sorted list of the ground 
speeds from the magnitude of the non-zero vectors representing the key points in 
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the encounter: 


R m = gs_line_eps(s, v 0 , v i5 - 1 ), 

Rp = gs_line_eps(s, v 0 , v*, +1), 

Cmr = gs circle(s, v 0 , Vj, T red , 1 ), 

C pr = gs_circle(s, v 0 , v i5 T red , + 1 ), 

^ma = gs circle(s, v 0 , Vj, T am f, er , 1 ), 

Cpa = 6® circle(s, v 0 , Vj, T am b er , +1), 

C'ran = gS circle(s, V 0 , Vj, Gentry? 1 )? 

Cpjx = gs circle(s, v G , v^, t en t ry ^ +1), 

C771X = gs circle(s, v 0 , v^, t ex n^ 1), 

= gs_circle(s, VojV^fex^j+l)- 

For completeness, 0 and the maximum ground speed are added to this list. A ground 
speed is chosen between every two sorted elements in this list and this ground speed 
is checked with a conflict probe like CD3D (see appendix A) to determine the color 
of the region. We do not offer a proof of correctness of this algorithm in this paper; 
this will be pursued in future work. A formal specification of the gs_line_eps 
function is presented in appendix B.l and a formal specification of the gs_circle 
function is presented in appendix B.2. 


7 Track Angle Prevention Bands 

Using the definition of v a from (8), we define a relative velocity vector that is a 
function of a as 


v = v a -v* (21) 

= (a; cos a - v ix , u sina — v iy , v oz - v iz ), 

where uj is the ground speed and is constrained by J 1 = v^ x + v^ y . The boundaries 
of the track angle prevention regions are those values of a that produce relative 
velocity vectors that are tangent to the protected zone. In this section we explore 
three ways to find these angles. 

Reference [5] describes an interesting situation when two prohibited regions are 
produced by a single aircraft pair. This situation is illustrated in the absolute 
reference frame by figure 17. As a check on our work, any equations we derive must 
be able to produce zero, two, or four a angles for certain encounter geometries. 

This section begins by looking at multiple ways to find the boundary angles for a 
pair of aircraft only considering the encounter geometry. Then we develop inequality 
reasoning that enables us to properly identify which regions are the conflict regions 
and which are conflict-free. Finally, we examine solution methods which restrict the 
regions based on a lookahead time. 
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Figure 17. Two Prohibited Regions 

7.1 Boundaries for Encounter Geometry Cases 

We know that tangent velocity vectors must satisfy (9). The most obvious way to 
find these tangent vectors involves substituting the definition of v from (21) into (9) 
and solving for the track angle, a. This approach yields a complex formula involving 
sin a and cos a. We can use the equality cos a = a/1 — sin 2 a and get a formula 
involving just sin a, but to remove the square root terms, we will have a large, 
fourth order polynomial in sin a. However, if instead of using (9) directly, we use the 
simplification captured in line_solution? (15), we arrive at a quadratic function 
of a, whose solution is much more practical. We pursue multiple approaches to solve 
this equation. The first two approaches find the vector components of v = (v x ,v y ). 
Then by (21), we can obtain a , as follows 4 

Ot = a/taufy/p T Vi Xl v y T Vi y ). (22) 

In other words, we defer the use of trigonometry until the end of the derivation. 
Of the two approaches that use (22), one is based on the development of the Q 
vector in section 5.2. The other method finds the vector components directly and is 
called the algebraic approach. The final approach finds a directly through complex 
trigonometric reasoning. Not surprisingly, this approach is called the trigonomet- 
ric approach. The first approach is the most mathematically succinct. The other 
approaches are presented in an attempt to be comprehensive. 

7.1.1 Boundaries by Q-theory 

From theorem 5.5, we know that k tangent _ 1 ine (s, e) is a velocity vector that is 
tangent to the protected zone and therefore satisfies (15). Computing the boundary 
track angles involves finding a k that satisfies 

v a — v* = k tangent _line(s, e). (23) 

4 We use the arctangent, atan (a, 6), as the arctangent of 6/a. The arctangent function in some 
programming languages reverses the order of these parameters. 
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Once this k is found, the boundary angles for each e can be found by (22). We 
claim that the needed k may be computed with the function in figure 18 pro- 
vided the v' parameter is tangent_line(s, e). This calculation masks the negative 



Figure 18. Computation of k for Track Solutions 

roots because they represent velocities in the opposite direction and hence they 
will never be used. To show this vector satisfies (23), it is sufficient to show that 
k tangent_line(s, e) + is a velocity vector with the same speed as v Q . Formally, 
this is stated as theorem 7.1. 

Theorem 7.1 (Calc_k). Letting k be calc_k(v', v D , v^, irt), then 

||fcv' + Vj|| = ||v 0 || 

when k is non-negative. 

Proof. calc_k is a solution of the following quadratic equation: 

ak 2 + bk + c = 0, 

(v') 2 fc 2 + 2(v' • Vi)k + vf = Vq, 

(kV + Vj) ■ (fcv' + Vj) = v„, 

(fcv' + Vi ) 2 = vl 

or ||fcv' + Vj|| = | |v 0 | | as required. □ 

We know that calc_k will satisfy (23), provided v' is tangent_line(s, e). We 
can combine these concepts may into a function (figure 19) to compute a velocity 
vector that is tangent to the protected zone. 
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Figure 19. Computation of Track Line Solutions 

7.1.2 Boundaries by Direct Algebra 

Now we pursue an algebraic approach to solve for the vector components of v. 
Starting from line_solution? (15), we have: 

Re (s -1 • v) = s • v, 

Rt i^x^y Sy*Vx) = T SyVy. (24) 

Assuming v x 7^ 0, we let p = we obtain: 

Rt («^a zP^x Sy'Ux) = ^x^x T SyP^x 5 

Rt (SxP ^y) = $x + SyPi 

ReSy + s x 

P = “■ 

Res x Sy 

Since v + v* = v a and ||v a || 2 = ||v 0 || 2 , then following a development similar to that 
presented in reference [4], 

l|Vo || 2 = ||v + V,|| 2 , 
v„ = v 2 + 2(v Vi) + vf, 

0 = «x(l + P 2 ) + 2v x(v ix + pv iy ) + V? - V 2 . 

This is a quadratic in v x with: 

a = (l + p 2 ), b = 2(vix + pv iy ), c = v 2 -v 2 . 

The root of this quadratic will give a solution to v x and from the definition of p we 
can obtain v y . Since v* is known, we can obtain v a from v = v a — v*. Four values of 
v x are possible since each value of e produces two p’s and for each of these p’s there 
are two solutions to the quadratic equation. Finally, we must address the special 
case when v x = 0. From (24) we have 

Re S X Vy = SyVy. 

If Res x = s y , then any v y can be used. If it is not equal, then v must be (0,0). 


29 




7.1.3 Boundaries by Trigonometry 

This section presents a trigonometric approach to finding the region’s boundaries. 


Using line_solution? (15) and v = 

v Q - 

Vi, we 

obtain: 

Re (s -1 

■v) 

= s • 

v, 

Re (s- 1 ■ (v Q - 

Vi)) 

= s * 

(v« - Vi), 

Re (s -1 v a ) — Re (s -1 

■Vi) 

= s * 

Vo - s • Vi, 

Re (s -1 ■ v Q ) — s 

■ V Q 

= Re ( s L ■ Vi) - s ■ Vi, 

v Q • (Re s x 

-s) 

= Vi 

■ (Re s -1 — s). 


Using (8), we have 

(u;coso, u;sino) • (— Res y — s x , Res x — s y ) = Vi • (Re s -1 — s). 
Rearranging terms we have 

u(Res x — s y ) sin a — cu(Res y + s x ) cos a = v* • (Re s 1- — s). 

Letting 

E = w(Res x — s y ), F ~ — uj(Res y + s x ), G = v* • (Re s x — s), 

we have: 

E sin a + F cos a = G. (25) 

Using a standard trigonometric identity (see appendix C), which is true as long as 
E and F are not both 0, we obtain 

E sin a + F cos a = \J E 2 + F 2 sin(o + atan(12, F)). 


From which we get 


sin(o + atan(F7, F )) = 


G 


\fW + F 2 ‘ 


If 


G 


Ve 2 +f 2 


< 1 then in some 2n range, we have 


a i = asm 


G 


V E 2 + F 2 
G 

02 = 7r — asin 


VE 2 + F 2 


atan (E, F), 

- atan(F?, F), 


since sin(o + atan(F?, F)) = sin(7r — a — atan (E,F)). These two angles are the 
boundaries of the region. Since E , F, and G are all functions of e, we have two 
pairs of a\ and 02 or four total angles. In specific cases, we may have fewer unique 


angles, for instance when 
o’s are equal). 


G 


y/E 2 +F 2 


> 1 or when the regions are adjacent (i.e., two 
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7.2 Regions for Encounter Geometry 

We intuitively know that if the mid-angle of a region produces a conflict within T re( i 
then all other angles in that region (between the boundary angles) will also produce 
conflicts within T re ^ in the encounter geometry case. We need to prove this formally. 
In other words, we seek a theorem of the form: 

Theorem 7.2 (MidAngle). 

Oil < o^m < a 2 AND 
a m = atan(v m ) AND 
ai = atan(vi) AND 
02 = atan(v2) AND 
a = atan(v a ) AND 
line_solution?(s, Vi) AND 
line_solution?(s, V2) AND 
1 1 v ?7i 1 1 = ||vi|| = ||v 2 || = ||v 0 || IMPLIES 
horizontal_conf lict?(s, v m ) 

Vo : a\ < O' < 02 : horizontal_conf lict?(s, v a ) 
where atan(v) = atan^, v y ). 

We have not yet been able to prove this theorem. Therefore, we proceeded with a 
more trigonometric approach (similar to the approach in section 7.2.1) that provides 
a rigorous basis for using the mid-angle and which also provides direct inequalities 
that delineate the regions. 

7.2.1 Regions From Trigonometry 

To determine color information for the regions between the boundaries, we de- 
velop trigonometric inequalities analogous to (25). We know from theorem hori- 
zont absolution (theorem 5.6) that a velocity vector that satisfies 

s • v < r(s _L • v) < — s * v 

is in horizontal conflict. Now we develop a theorem that relates these inequalities 
to serve as a condition for testing an angle a. 

Theorem 7.3 (EFG). 


s 2 - D 2 > 0 => 
s • v < R( s -1 ■ v) < — s • v 

(Ei sin a + F\ cos a > G\ AND E2 sin a + F2 cos a < G2) 
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where 


R _ Vs 2 -o ' 2 ^ = uj(Rs x - s y ), E 2 = v(Rs x + s y ), 

U) = ||v 0 ||, Fi = -u;(ft!% + s x ), F 2 = a;(— lte y + s x ), 

v = (a; cos a, a; sina) — v*, Gi = v* * (72s- 1 — s), G2 = v* * (Rs 1 - + s). 

Proof. Although this looks complicated, algebraic manipulation after substituting 
all definitions proves the result. □ 

Prom a prevention band standpoint, we want to know the range of track angles 
(range of a) that cause these linear combinations 

Ei sin a + F\ cos a > Gi, (26) 

E 2 s±na + F 2 cosa < G 2 , (27) 

to be true — so we can avoid them. These results are trigonometric and can be solved 
without regard to the specific values of E , F, and G developed in theorem 7.3. We 
begin with the following theorem which given an angle in a certain 2tt range and 
the satisfaction of a linear combination, then we know the angle is in a more narrow 
range. 

Theorem 7.4 (angle_limit_ge). Assuming E 2 + F 2 > G 2 and some integer i, 
2ttz - | < x < 2ir(i + 1) - | AND 
.Esin(;r — atan(£', F )) + Fcos(:r — atan^, F )) > G 


2m + narrow(P, F 1 , G, — 1) < x < 2m + narrow(P, F, G, 1) 

where 

narrow (E,F,G,e) = -easin ( ^^== ) + ^(e + 1), 
where , e = 1 ore = — 1 . 


Proof. Forward implication case: Prom the linear combination theorem (see ap- 
pendix C), we get 

Esin(x— atan^, F )) + Fcos(x — atan (E, F )) 

= \J E 2 + F 2 s±n(x — ata n(F7, F ) + atan(E', F )) 

= \J E 2 + F 2 sin(x). 

Then we can follow with this derivation 


+ F 2 

sin(x) 

> 


sin(x) 

> 

asin(i 

sin(x)) 

> 


G 

Ve 2 + f 2 ’ 


G 

V E 2 + F 2 J ' 
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At this point we have two possibilities, depending on where the angle x — 2m falls 
in a range of values. If — f < x — 2m < | then, asin(sin(x)) = x — 2m. So, 


x — 2m > asin 
x > asin 


G 


Ve 2 + f 2 J ’ 

G 


+ 2m, 


y/E 2 + F 2 , 
x > narrow^, F, G, — 1) + 27ri, 


(28) 


or if | < x — 2m < then asin(sin(x)) = 7r — (x — 2m). So, 


7r — {x — 27ri) > asin 

—(x — 2m) > asin 

x — 2m < 


G 


y/E 2 + F 2 
G 

y/E 2 + F 2 
G 


asm 


7T, 

+ 7T, 


y/E 2 + F 2 

x — 2m < narrow(F, F, G, 1), 

x < narrow(F, F, G, 1) + 2m. 

With these two conditions (28) and (29), the forward implication is proven. 
Backward implication case: two standard trigonometric results state that 

— ^ < a, b < ^ IMPLIES sin(a) > sin(6) a > b, 

7T , 37T / v x 

— < a, 6 < — IMPLIES sin(a) < sin(b) <=> a > b. 


(29) 


(30) 

(31) 


By combining these two results with the antecedent of the backward implication — 
narrow(F, F, G, — 1) < x — 2m and x — 2m < narrow(F, F, G, 1) — we can state 

sin(x — 2m) > sin(narrow(F, F, G, — 1)), 

sin(x — 2m) > sin(narrow(F, F, G, 1)). 

Depending on the value of x , the preconditions of only one of (30) or (31) applies. 
However, which one is true doesn’t matter because 


sin(narrow(F, F, G, —1)) = sin(narrow(F, F, G, 1)) = 


Note also, that sin(x — 2m) = sin(x). Thus, 


G 


y/E 2 +F 2 ' 


s±tl(x — 2m) 

> 

sin(narrowl 

sin(a?) 

> 

G 

y/E 2 + F 2 

yj E 2 + F 2 sin(x) 

> 

G. 
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We can transform this last formula into 


Es±tl(x — atan (F,F)) + F cos(x — ata n(F, F)) > G, 

by the linear combination theorem (see appendix C) and the backward implication 
is proved. □ 

By similar reasoning we can prove 

Theorem 7.5 (angle_limit_le). Assuming E 2 + F 2 > G 2 and some integer i, 

2m + | < x < 2t r(i + 1) + | AND 

Fsin(:r — atan(F, F)) + Fcos(x — atan (E, F)) < G 

2m + narrow(F, F, G, 1) < x < 2ir(i + 1) + narrow(F, F, G, —1). 

Now we need to collect these results (angle_limit_ge 5 angle_limit_le) to 
develop a range of angles that will satisfy (26). Since a represents the track angle of 
the aircraft, we know that its range is between 0 and 2ir. If we let x = a+atan(i?, F), 
then the precondition of angle_limit_ge changes to 

2iri — ^ — atan(F, F) < a < 2i t{% + 1) — ^ — atan(F, F), 

for some value of i. Since the range of atan(F, F) is also between 0 and 27r, this 
precondition can be satisfied over the full range of a for three values of i: 0, 1, and 
2. With these three values of i and using angle_limit_ge, we get three ranges of a 

narrow(F, F, G, — 1) — atan(F, F) < a < narrow(F, F, G, 1) — atan(F, F), 

27T + narrow(F, F, G, —1) — atan(F, F) < a < 2iv + narrow(F, F, G, 1) — atan(F, F), 

47T + narrow(F, F, G, — 1) — atan(F, F) < a < 47r + narrow(F, F, G, 1) — atan(F, F). 

The last condition is met trivially, since a cannot be greater than 2n. Eliminating 
this conditions yields the ranges 

a > narrow(F, F, G, —1) — atan(F, F), (32) 

a < narrow(F, F, G, 1) — atan(F, F), 

a > 2n + narrow(F, F, G, — 1) — atan(F, F), (33) 

a < 27r + narrow(F, F, G, 1) — atan(F, F), 

a > 47T + narrow(F, F, G, — 1) — atan(F, F), (34) 

a < 2 tt. 

Thus if a particular angle is within any of these ranges, then we know that the linear 
combination formula is satisfied at that angle. 
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Using a similar development, the precondition to angle_limit_le 

2m + ^ — atan^, F) < a < 27 r(i + 1) + ^ — atan(i£, F) 

can cover the entire 0 to 27r range of a if i is -1, 0, and 1. From the angle_limit_le 
theorem, these three values of i yield the following three ranges of a 

a > 0 (35) 

a < narrow (E, F 1 , G, —1) — atan(F7, F 1 ), 

a > narrow (F7, jF, G, 1) — ata n(F7, F), (36) 

a < 27T + narrow^, F, G, —1) — at an(£’,F’), 

a > 27T + narrow(F7, JF, G, 1) — atan(F?, F 1 ), (37) 

a < 47T + narrow(F7, F 1 , G, — 1) — atan(F?, F), 

which will ensure the linear combination is satisfied. 

To summarize all these results, if an angle a satisfies one condition among (32), 
(33), or (34) and it also satisfies one condition from (35), (36), or (37), then we 
know that both theorems angle_limit_ge and angle_limit_le are satisfied, hence 
theorem 7.3 is satisfied, and thus we know that this angle results in a conflict in the 
horizontal dimension (theorem 5.6). 

A few comments should be made about these ranges of angles. First, it is 
not necessarily the case that all three conditions are defined. For some values of 
atan(E', F), a condition may be unsatisfiable for any value of a in the range 0 to 27r. 
Also, these conditions include an “equal to” and are not a strict < or > relation. The 
“equal to” parts of these conditions exactly correspond to the boundaries developed 
in section 7.1.3 and thus can be ignored. Finally, one may wonder why three ranges 
of a are provided with these conditions when figure 17 and the surrounding text 
states that only two regions are possible. This is only an apparent problem. The 
discrepancy comes from forcing the angle a in the range 0..27T. A prevention region 
could begin near 27r and “wrap around” to angles larger than 0. Thus two contiguous 
regions could span all three conditions. 

7.2.2 Mid-Angle Approach Revisited 

From the previous section we know that 

horizontal_conf lict?(s, v a ) 

271 'i — ^ — atan(i?, F) < a < 2i r(i + 1) — ^ — ata n(F?, F). 

Consider the function representing the separation distance between the two air- 
craft minus the diameter of the protected zone. This function is closely related to 
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horizontal conflict?. We claim, but have not yet proven, that this function 
is continuous. With this assumption, we can apply the following lemma to this 
function. 

Lemma 7.6 (zeros_lem). If f is continuous on the open interval (xi,x u ) and 
f(xi) = 0, f(x u ) = 0 and there are no other zeros between xi and x u , then f is 
either positive at every point in the interval or negative everywhere in the interval. 

The zeros of / satisfy line_solution?. By the above lemma, all angles between 
the zeros will all share the same conflict status (either red or green). Therefore, any 
angle between them (for our purposes, the mid-angle) can be used to determine how 
the region should be colored. We will use the mid-angle as a representative angle in 
following section. 

7.3 Lookahead Time Analysis 

In section 7.2, we developed solution techniques for prevention bands considering 
only the encounter geometry; now we consider ways to ignore those aircraft that are 
“too far” away. As described in section 3.2, a protected zone that cannot be reached 
within the lookahead time can be ignored. When all points of a protected zone 
may be reached within the lookahead time, then the solutions from the encounter 
geometry calculations may be used without modification (see section 7.1.1). It is only 
when the protected zone intersects the lookahead time that a special solution must 
be found, which is the purpose of this section. We will examine several approaches 
to solve this problem. 

Each of these approaches uses a conflict probe to determine whether an angle is 
in conflict or not. One question is whether a 3-dimensional conflict problem (CD3D, 
see appendix A) should be used or if a strictly horizontal, 2-dimensional probe should 
be used instead. This question cannot be answered formally, but rather is based on 
human factors knowledge. Would a pilot, looking at a horizontal display, expect that 
separation must occur only in the horizontal dimension? If so, then a 2-dimensional 
probe is preferred. We will not pursue this question any further, but for convenience 
of presentation we will use CD3D from now on. 

7.3.1 Conservative Boundary Approach 

The easiest way to handle the case where only part of the protected zone is within 
the lookahead period is to be conservative. We begin with a region that creates 
a conflict when considering only the encounter geometry (see section 7.2.2). Next 
we find the time when the ownship will reach the tangent point (represented by 0, 
as defined in (4) and 5) at each of the boundaries for this region. If either time is 
within the lookahead time, then the whole region is prevented (i.e., painted red). 

The advantage of this approach is its simplicity — especially in terms of analysis; 
the disadvantage is that certain track angles are safe, but are painted red. Other 
approaches attempt to avoid losing many of these potential solutions. 
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7.3.2 Iterative Approaches 

A variation on the full iterative approach (see section 2) is to step through the 
angles, starting at the boundaries from the encounter geometry solution and call 
CD3D at each angle. If we examine the angles 

OLU ^2 5 -"5 * * ■ 5 ***5 C^end 

and we find that a m is the first angle with a conflict and angle a n is the last angle 
with a conflict, then we can conclude that all the angles from a m -i to a n +i should 
be prohibited. 

A similar, but more efficient approach is instead of using a constant step size 
between angles, bisect the angles to find the boundaries of the region. This should 
execute in logarithmic time, instead of linear time. 

7.3.3 Algebraic Approach 

In this section we develop an algebraic method to solve for the points where the 
lookahead time, T, intersects the protected zone. We begin by finding the velocity 
vectors where the ownship will touch the protected zone at precisely the lookahead 
time, as illustrated by figure 20. Depending on the traffic’s velocity, the lookahead 


T 



Figure 20. Track Angle with Lookahead Time 

time may not be symmetric around the axis formed by the position of the two 
aircraft. The points where the lookahead time and the protected zone intersect 
are combined with the regional boundaries only considering the encounter geometry 
(section 7.1.1) and the midpoint between these points is tested with the conflict 
probe, CD3D. The result of the conflict probe is used to characterize the entire 
region (that is, to paint it red, amber, or green) between these points, as described 
in section 7.2.2. We observe that the intersection points between the lookahead time 
and the protected zone are precisely those points where the relative position vector 
at time T equals the diameter of the protected zone, or formally, when 

||s + Tv|| =D. 

An equivalent formula, which is easier to solve is 

||s + Tv|| 2 = D 2 . (38) 
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Since this equation involves a square, there will be two solutions for v. Thus, to find 
the intersection points we must solve for the components of the vector v (i.e., v x 
and v y ). With these components, the track angles from the ownship velocity vector, 
v a , can be obtained by (22). The key theorem that enables us to compute these 
components is: 

Theorem 7.7 (TrackCircle). Let v = v a — v*, ||v a || = ||v 0 ||, and T be a time. 
Then ||s + Tv|| 2 = D 2 , provided v ax is the solution of the quadratic equation Av^ x + 
Bv ax + (7 = 0 and sign(— 2 P y Tv ay ) = s±ga(E + 2 P x Tv ax ), where 

P = s -Tvi, A = 4T 2 ||P|| 2 , 

E= ||P|| 2 + T 2 w 2 — D 2 , B = ATEP X , 

C = E 2 — A P 2 T 2 w 2 . 

Proof. First, we establish that 

||s + Tv|| 2 = D 2 —2P y Tv ay = E + 2P x Tv ax . 

This follows from substitution and simple algebraic manipulation: 

\\s + Tv \\ 2 = D 2 , 

\\s-Tvi + Tv a \\ 2 = D 2 , 

\\P + Tv a \\ 2 = D 2 , 

||P|| 2 + 2T(P • v a ) + T 2 v 2 = D 2 , 

0 = ||P|| 2 + T 2 v 2 - D 2 + 2T(P • v a ) recall: v 2 = v 2 , 

0 = E + 2T(P • v a ), 

—2 P y Tv ay = E + 2 P x Tv 

ax • (39) 

Next we square both sides of (39), to obtain 

(—2 P y Tv ay ) 2 = (E + 2 P x Tv ax ) 2 . 

This step requires the condition sign(— 2P y Tv ay ) = sign(E' + 2P x Tv ax ). Next we 
substitute v 2 x + v 2 y — u 2 x for v 2 y (i.e., ||v a || = ||v 0 || ). This yields 

4 P 2 T 2 (v 2 x + v% - v 2 ax ) = E 2 + AP x Tv ax E + 4 P 2 T 2 v 2 x . 

Solving for v ax we obtain the quadratic with A , 5, C as prescribed. □ 

We use the quadratic in the Track Circle theorem to obtain the two roots v ax . 
To complete the solution we solve for v ay as follows 

Vay ±yfeox + ^oy ^ax m 

Now we must decide whether to choose the positive root or the negative root for 
v ay . To satisfy the preconditions to Track Circle, we choose the sign of v ay so that 

sign(-2 P y Tv ay ) = sign(T; + 2 P x Tv ax ) 
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track_circle(s, v 0 , v*, t, irt) = 

P = s-fv*, 
e = P 2 + t 2 Vg — D 2 , 
a = 4f 2 P 2 , 
b ~ UeP x , 
c = e 2 — 4 P 2 i 2 v 2 
IF discr(a, b, c) > 0 THEN 
v 'ox = root (a, b,c, irt), 

IF sign(— P = sign(e + 2 P' x , t v' ox ) THEN £ 

ELSE £ = -1 

IF V 2 - (^J 2 > 0 THEN 

v'oy = - Kx) 2 

ft/ {/ ) 

V^ox’ oy/ 

ELSE 

( 0 , 0 ) 

ENDIF 

ELSE 

( 0 , 0 ) 

ENDIF 


Figure 21. Track Circle Function 




is satisfied. In this way, the two roots for v ax with their companion v ay give us 
two potential solutions, say v ai and v tt2 . The function in figure 21 provides these 
solutions. This function produces a zero vector when the quadratic equation from 
the Track Circle theorem cannot be solved. The meaning of a zero vector in these 
cases is that the lookahead time boundary and the protected zone do not intersect. 
In these cases, only the boundaries from the encounter geometry are used, unless 
the protected zone is too far away, then it is ignored all together. The PVS version 
of the track_circle algorithm is presented in appendix B.4. 

The track_circle function finds both entry points and exit points to the pro- 
tected zone. In many situations only one of these solutions are needed. Figure 22 
illustrates a situation where only the entry point solution of the track_circle func- 



Figure 22. Exit Point from Track Circle 


tion is relevant. This figure is in the translated frame of reference where the traffic 
aircraft (black dot) is at the origin. The blue dot shows the position of the ownship 
and the blue vector its current trajectory. The black circle shows the protected 
zone around the traffic. The cyan circle shows all possible relative locations at the 
lookahead time, if the ownship were to change only its track angle. The cyan circle 
intersects the protected zone in two places, but only the entry point (right-most 
intersection) affects the protected bands. The net result is that only one side of the 
bands is affected, as illustrated in figure 23. The green-red circle shows what the 
prevention bands would look like if the entire region between the tangent points are 
colored red. The outer blue-red-amber bands show the impact of using Track Circle. 
The amber region shows the part of the bands, which is no longer red because it 
falls outside of the finite lookahead time. The algorithm that is presented in this 
paper is not harmed by the inclusion of the extra solutions (e.g. the exit point in 
the above scenario). However, it is essential that no critical point is omitted. We 
have decided to not filter out the extra solutions (and potentially gain a little more 
efficiency) in our first version of the algorithm. After a fully formal proof has been 
constructed, we may filter out the extraneous solutions. 
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Figure 23. Bands with Exit Point 


7.3.4 Trigonometric Approach 


Like the algebraic approach, the trigonometric approach begins with a lookahead 
time T and (38), then proceeds in a similar way to the Track Circle theorem. 

||s + Tv|| 2 = D 2 , 

||s -Tvi + Tv q || 2 = D 2 , 

\\P + Tv a \\ 2 = D 2 , 

P 2 + 2T(P • v«) + T 2 v 2 = D 2 , 

where P = s — TV*. Using v Q = (u> cos a, u since) and v 2 = u 2 , we can write 
2T(P ■ v Q ) = D 2 - ||P|| 2 - TV, 

2 TP x u cos a + 2 TP y u sino; = D 2 — ||P|| 2 — T 2 u 2 . 

We can now cast this formula in the form of (25), 

E cos a + F sin a = G, 


where 

E = 2TP x u, F = 2TP y u, G = D 2 - ||P|| 2 - TV. 

We can apply the linear combination theorem (see appendix C, pg. 56) in a manner 
similar to section 7.1.3, and get 

sin(a + atan^, F)) = H , 

where 

G 

VE 2 + F 2 ' 

Thus, if \H\ < 1 then in some 2n range, we have 

ai = asin(iJ) — ata n(£', F), 

02 = 7T — asin (H) — ata n^, F), 

since sin(o + atan^, F )) = sin(7r — a — atan(£', F)). Just as in the algebraic case 
(section 7.3.3), we must evaluate these angles to ensure they yield entry points at 
the lookahead time. 
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7.4 Vertical Considerations 


Similar to section 6.3, we have ignored the impact of the aircraft’s vertical speed. 
If the aircraft are in conflict horizontally but not vertically for a particular track 
angle, the prevention band should be green at that angle. Only if there is both 
horizontal and vertical conflict should that track angle be prevented (i.e., painted 
red). We can use (19) and (20) to find the entry time and exit times into the vertical 
protected zone. To avoid unnecessarily prohibiting angles, we must ensure that all 
track angles that occur before the t entry are allowed. Furthermore, if t ex u is before 
the time to reach the tangent point, then all track angles between these times should 
be allowed. The track angle that corresponds to these times may be found using the 
Track Circle Theorem (theorem 7.7) and track_circle function in figure 21 (see 
also algorithm trk_circle, presented in appendix B.4). The parameter T of the 
theorem is instantiated with t entry / exit . 


7.5 Sketch of a Track Angle Algorithm 

The idea of the algorithm is to find the critical track angles from the encounter 
geometry, the lookahead time, and the vertical considerations. Then sort this list 
of angles and use the conflict probe (CD3D, see appendix A) at the angle between 
each of the critical angles to characterize the region (i.e., determine which color 
the region should be painted: green, amber, or red). These critical vectors may be 
computed as 


Rmm = track_line(s, v 0 , v*, -1, -1), 

K mp = track_line(s, v G , v*, -1, +1), 

K pm = track_line(s, v G , v*, +1, —1), 

K pp = track_line(s, v G , Vj, +1, +1), 

C rm = track_circle(s, v G , v*, T red , -1), 

C rp = track_circle(s, v G , v*, T red , +1), 

Cam = track_circle(s, v G , v*, T amber , -1), 

C ap = track_circle(s, v 0 , Vj,T am6 er 5 +l), 

C em = track_circle(s, v G , v*, t entry , -1), 

C ep = track_circle(s, v G , v*, t entry , +1), 

C xm = track_circle(s, v G , v*, t exiu -1), 

C xp = track_circle(s, v G , v*, t exiu +1). 

Some of these vectors may be zero vectors in which case they are ignored. Then 
the track angles are found using the at an function. Finally, to provide appropriate 
bounding, the angles 0 and 2n must be added. 

We do not offer a proof of correctness of this algorithm in this paper. This will 
be pursued in future work. 
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8 Conclusions 


The mathematics underlying conflict prevention systems is more subtle than ex- 
pected. A direct approach (for the bands of track angles) easily carries one into 
the domain of fourth-order polynomial equations in sin a. In this paper, we have 
elaborated several different mathematical approaches to find regions of prevention 
bands. These approaches roughly fall into three categories: iterative, algebraic, and 
trigonometric. The mathematical development divides the problem into encounter 
geometry considerations, which incorporate conflicts from all aircraft, and looka- 
head time considerations, which filter conflicts based on their nearness (in time) to 
the ownship. Since the lookahead time is parametrized as T, the same mathemati- 
cal development can be used to examine at immediate warnings (colored red), and 
near-term warnings (colored amber). 

Using this strong mathematical basis, we intend to formally verify algorithms to 
implement these mathematical formulas. Initial algorithms have been sketched out, 
but have not been verified. In future work we will select from the methods provided 
in this paper to develop an efficient algorithm for the generation of prevention bands. 
At this point we favor the Q-theory algebraic approach because we see this as the 
most efficient approach and the most mathematically succinct. In addition, we 
expect the formal proofs of the algorithm will not be overly difficult. From an 
implementation standpoint, an iterative method may be preferred; however, as we 
mentioned earlier, simple iterative solutions such as presented in section 2 have 
both correctness and completeness issues. Due to safety concerns the correctness 
issues must be addressed and for efficiency reasons the completeness issues must be 
evaluated to determine their impact. 

The non-iterative approaches set forth in this paper are limited to cases where 
only two aircraft are involved. As alluded to in section 3, an algorithm is needed 
to merge the regions of angles from each traffic aircraft into a single collection 
of conflict prevention information. Future work involves specifying, verifying, and 
implementing this algorithm. 

Beyond these developments, we also intend to use the mathematics developed 
in this paper as a foundation for evaluating the traffic complexity and to develop 
techniques for down-selecting solutions from conflict detection and resolution algo- 
rithms, which produce multiple conflict resolutions. 
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Appendix A 


Conflict Detection in 3D Space: CD3D 


This appendix describes a formally verified three dimensional conflict detection 
algorithm called CD3D. The algorithm works on a pair of aircraft: the ownship and 
a single traffic aircraft. By methodically calling this function for each traffic aircraft 
and combining the outputs, this algorithm may be used as the basis of a conflict 
probe. CD3D returns TRUE if and only if there is a time t less than the lookahead 
time T, where there is both vertical and horizontal loss of separation. To estimate 
future states of the aircraft, this algorithm performs a linear extrapolation of state 
information (position and velocity). The algorithm is decomposed into two cases: 

• v z = 0, i.e., no vertical speed 

• V z ^0 

In the first case, the problem is essentially 2-dimensional. The second case is more 
difficult. We will develop some preliminary lemmas before we undertake these two 
cases. 

A.l Two Dimensional Preliminaries 

The mathematics underlying horizontal 2D conflict detection is the intersection of 
the ownship’s trajectory with the protected zone (a circle). As mentioned above, 
this problem is equivalent to finding if there is a time, £, where the trajectory is 
within the protected zone. A quadratic equation to find this time is 


t 2 v 2 + 2(s • v) t + s 2 - D 2 = 0, 


with 

a = v 2 , b = s • v, c = s 2 — D 2 . 

This equation is the same as (3) and the derivation of this equation is presented 
in section 4.1. The roots of this equation give us the exit and entry times into the 
protected zone. We repeat (4) and (5), which represent these times: 

-b—Vd -b + Vd 

= , 

a a 

where d is the discriminant and equals b 2 — ac. The following expanded form of the 
discriminant is used by CD3D: 

d = (s-v) 2 + v 2 (s 2 -D 2 ) 

= (S X V X + SyVy) 2 + V 2 D 2 - 0 «£ + t£)(4 + S 2 y ) 

= 2 (s x s y v x Vy) + v 2 D 2 - (s 2 x v 2 + vls 2 y ) . 


45 



This equation is equivalent to the form presented in (9) and the further development 
of this equation is not necessary for the conflict detection problem. The conflict 
resolution problem — represented by the development after (9) — attempts to find 
the velocity vector v, where in the conflict detection problem, the vector v is known 
and is equal to v G — v*. 

If the discriminant is less than or equal to zero, then the ownship’s trajectory 
does not intersect the horizontal protected zone and there is no conflict. Thus, a 
condition for conflict detection is that d > 0. 

We now proceed to develop the logic of CD3D for two cases: if v z = 0 and if 
v z ± 0 . 

A. 2 When v z — 0 

When v z = 0, CD3D reduces to a 2-dimensional problem. For CD3D to return TRUE, 
first we must ensure that we have a conflict in the vertical dimension, formally, that 


—H < s z < H. 


Next, we must ensure that d > 0. Finally, we determine that the lookahead time, 
T, is after the entrance time into the protected zone and that the exit time is not in 
the past. Formally, these conditions are ©_ < T and 0+ > 0. We claim that these 
conditions are satisfied by the following conditions: 

(. D 2 > s 2 OR b < 0) AND (d > ( aT + b) 2 OR ( aT + b) > 0) . 

This relationship is proved by the lemmas A.l and A. 3. The lemmas are stated with 
a generic time t, because they will be used slightly differently in the next section. 

Lemma A.l (thetal lt_t). If the discriminant is non-negative, then 

0_ < t d > {at + b ) 2 OR at + b > 0. 


Proof. 


©_ < t 


-b-Vd 

a 


< t 


— yfd < at + b 

d > {at T OR at -1-6^0. 


n 

To resolve the second condition, we need to determine if 0+ > 0. The proof of this 
result requires the proof of the next lemma. 
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Lemma A. 2 (theta2_gt_t). If the discriminant is non-negative , then 


Proof. 


d > (at + b ) 2 OR at + b < 0 0+ > t. 


0 + > t < 

-b + Vd 


> t 


a 

\[d > at + b 

d > {at &) 2 OR at -b b ^ 0. 


Lemma A. 3 (theta2_gt_0). If the discriminant is non-negative , then 

D 2 > s 2 OR b < 0 0 - 1 - > 0. 


□ 


Proof. Using lemma theta2_gt_t with t = 0, we have 

d > b 2 OR 6 < 0 <<==>> © + > 0. 

But the first condition d > b 2 can only occur when there is a loss of separation, i.e., 
s 2 < D 2 : 

d > b 2 <—> 
b 2 — ac > b 2 *<=>> 

— ac > 0 -<==> 

v 2 [s 2 — D 2 ] < 0 <*=► 

s 2 — D 2 < 0 since v 2 > 0, 

s 2 < D 2 . 

□ 


A. 3 When v z ^ 0 

If ^ 7 ^ 0, then we must deal with both the two dimensional considerations in the 
previous section and we must also deal with the times when loss of separation occurs 
vertically. We repeat (19) and (20) that give the times to enter and exit the vertical 
protected zone: 


t 


entry 


iexit 


— signQz)# - Sz 

Vz 

sig n(v z )H - Sz 

Vz 


5 
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If either of these times is negative, then this time is undefined; for instance, when an 
aircraft is below the protected zone and its vertical speed is negative. Furthermore, 
since H > 0, Gentry ^ t exit - 

This problem breaks into two cases: a special case is when the ground speed is 
zero ( v x = 0 and v y = 0) and the general case when the ground speed is non-zero 
(' v x ^ 0 or v y ± 0). Recognize that the speed here is the relative ground speed 
between the two aircraft, so the special case is physically realistic. We handle the 
special case first. 

A. 3.1 When v x = 0 and v y = 0 

In this case there can only be a conflict if there is already a loss of separation 
horizontally, so the test s 2 < D 2 is performed. If there is also a vertical loss of 
separation (i.e., —H < s z AND s z < H ) then there is a loss of separation, which — 
by definition — is a conflict. Otherwise, the vertical velocity will cause a conflict 
within the lookahead time, provided 

0 ^ t exit AND t en f, ry < T. 

By expanding the definition of t entry , and performing algebraic manipulations, we 
have the conditions: 

v z >0 AND 5^<0 AND — H < s z + Tv z OR 
v z <0 AND s* > 0 AND H > s z + Tv z . 

A. 3 . 2 When v x 7 ^ 0 or v y 7 ^ 0 

The general case involves all four key times associated with detection: 

• 0_, the time to enter protected zone horizontally 

• ©+, the time to leave protected zone horizontally 

• tentry ? the time to enter protected zone vertically 

• t eX it , the time to leave protected zone vertically 

If these times are properly ordered then there is a conflict. First we must ensure 
that both a horizontal and vertical loss of separation occurs within the lookahead 
time, that is: 


0 ^ t ex if AND t en i ry <! T, 

0 < ©+ AND 0_ < T. 

Finally, we must ensure that the two intervals of time overlap. This can be ensured 
with 

©_ < t ex n AND t en f ry < ©_|_. 

To summarized these six conditions 
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Condition 

is equivalent to 

by 

Gentry ^ T 



t'exit ^ 0 



0+ > 0 

D 2 > s 2 x + s 2 v OR 6 < 0 

lemma theta2_gt_0 

T > 0_ 

d > (clT + b) 2 OR clT + b > 0 

lemma thetal_lt_t 

t exit C — 

d > (at2 + b ) 2 OR at2 + b> 0 

lemma thetal_lt_t 

Gentry ^ ©+ 

d > (ati + b) 2 OR at\ + b < 0 

lemma theta2_gt_t 


These are precisely the conditions that are checked in CD3D when v z ^ 0. 

A. 4 CD3D Algorithm 

The CD3D algorithm, expressed in the PVS specification language, is shown in 
figure Al. 
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s : VAR Vect3 XX Relative position of the ownship wrt traffic 

v : VAR Vect3 XX Relative velocity of the ownship wrt traffic 

D : VAR posreal XX Minimum horizontal separation 
H : VAR posreal XX Minimum vertical separation 
T : VAR posreal XX Lookahead time 


CD3D (s,v,D,H,T) : bool = 

LET (sx 9 sy,sz) = s, 

(vx,vy,vz) = v IN 

IF vx=0 AND vy=0 AND sx*sx+sy*sy < D*D THEN XX No horizontal movement 

(-H < sz AND sz < H) OR XX Already in conflict 

(vz > 0 AND sz < 0 AND -H < T*vz + sz) OR XX Vert, conflict in future 

(vz < 0 AND sz > 0 AND H > T*vz + sz) 

ELSE 

LET d = 2*sx*vx*sy*vy + D*D*(vx*vx + vy*vy) - 
(sx*sx*vy*vy + sy*sy*vx*vx) IN 
IF d > 0 THEN 


LET a = vx*vx + vy*vy, 
b = sx*vx + sy*vy IN 

XX thetal = (-b - sqrt(d))/a, first intersection with D 
XX theta2 = (-b + sqrt(d))/a, second intersection with D 
IF vz = 0 THEN XX Horizontal movement only 
-H < sz AND sz < H AND 

(D*D > sx*sx + sy*sy OR b <= 0) AND XX theta2 > 0 
(d > (a*T+b) * (a*T+b) OR a*T+b >= 0) XX thetal < T 


ELSE XX General case 

LET tl = (-sign(vz)*H-sz)/vz, 
t2 = (sign(vz)*H-sz)/vz IN 

XX tl < t2 

(d > (a*t2+b) * (a*t2+b) OR a*t2+b >= 0) 
(d > (a*tl+b) * (a*tl+b) OR a*tl+b <= 0) 
XX max (thetal ,tl) < min(theta2,t2) 

(D*D > sx*sx + sy*sy OR b <= 0) 
t2 > 0 

(d > (a*T+b) * (a*T+b) OR a*T+b >= 0) 
tl < T 
ENDIF 

ELSE FALSE 
ENDIF 
ENDIF 


AND XX thetal < t2 
AND XX tl < theta2 

AND XX theta2 > 0 
AND XX min(theta2, t2) 
AND XX thetal < T 

XX max(thetal,tl) 


> 0 
< T 


Figure Al. CD3D Algorithm 
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Appendix B 


Horizontal Algorithms 


In this section the PVS versions of the horizontal algorithms are provided, These 
algorithms are abstract and are defined over the reals. We have not considered the 
issues associated with the finite precision provided by a floating point implementa- 
tions, which are used in conventional programming languages such as C++ or Java. 
The algorithms are defined as functions with a highly constrained return type. In 
other words, the return types convey the key properties of the function. These 
return types rely on a few additional predicates: 

vl,v2 : VAR Vect2 

gs_only?(vl) (v2) : bool = EXISTS (l:posreal): v2 = l*vl 
trk_only?(vl) (v2) : bool = norm(v2) = norm(vl) 
nz_vect2?(v: Vect2) : bool = v /= zero 

The following types are also used: 

Sp_vect2 : TYPE = {s : Vect2 I sqv(s) >= sq(D)> 

Ss_vect2 : TYPE = {s : Vect2 | sqv(s) > sq(D)> 

Nz_vect2 : TYPE = {v: Vect2 | v /= zero} 

Nzv2_vect3 : TYPE = {v I nz_vect2? (v) } 

In addition to these definitions, the algorithms rely on utility functions providing 
vector operations and the roots of quadratic equations, see sections B.5 and B.6. 


B.l Ground Speed Line Algorithm 

The ground speed line algorithm is defined as follows in PVS: 


sp : 

VAR Sp_vect2 



ss : 

VAR Ss_vect2 



eps : 

VAR Sign 



vo, vi , v, 




nvo,nvi : 

VAR Vect2 



nzv : 

VAR Nz_vect2 



alpha (ss) 

: {x:posreal I 

X < 1} = 

sq(D)/sqv(ss) 

beta(ss) 

: unreal = D*sqrt (sqv(ss) -sq(D) )/sqv(ss) 

Qx(ss,eps) 

: MACRO real 

= alpha(ss 

)*ss‘x + eps*beta(ss) *ss c y 

Qy(ss,eps) 

: MACRO real 

= alpha(ss 

)*ss‘y - eps*beta(ss) *ss c x 
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Q(ss,eps) : Vect2 = (Qx(ss,eps) ,Qy(ss,eps)) 

Qs(ss,eps) : Vect2 = 

Q(ss,eps)-ss 

tangent_line(sp,eps) : Nz_vect2 = 

IF on_D? (sp) THEN 
eps*perpR(sp) 

ELSE 

Qs(sp,eps) 

END IF 

gs_only_line(v, vo, vi) : {k: real , nvo :Vect2 | nz_vect2? (nvo) => 

gs_only? (vo) (nvo) AND 
k*v = nvo-vi} = 

IF det (vo, v) /= 0 THEN 

LET k = det(vi,vo)/det(vo,v) , 

1 = det(vi,v)/det(vo,v) IN 
IF 1 > 0 THEN 
(k,l*vo) 

ELSE 

(0,zero) 

END IF 
ELSE 

(0,zero) 

END IF 

gs_line_eps(sp,vo,vi,eps) : {nvo I nz_vect2? (nvo) => 

gs_only?(vo) (nvo)} = 

LET (k,nvo) = gs_only_line(tangent_line(sp, eps) , vo , vi) IN 
IF nz_vect2? (nvo) AND k >= 0 THEN 
nvo 
ELSE 
zero 
END IF 

B.2 Ground Speed Circle Algorithm 

The ground speed circle algorithm is defined as follows in PVS: 


s,nvo 

VAR Vect3 

vo, vi 

VAR Nzv2_vect3 

dir , irt 

VAR Sign 

vnzo 

VAR Nz_vect2 

d,t 

VAR posreal 
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gs_only_circle(s, vnzo, vi ,d,t ,irt) : {nvo I nz_vect2? (nvo) => 

gs_only?(vnzo) (nvo) AND 
sqv(s+t* (nvo-vi) ) = sq(d)} = 

LET w = s-t*vi, 

a = sq(t)*sqv(vnzo) , 
b = t*(w*vnzo), 
c = sqv(w)-sq(d) IN 
IF discr2b(a,b,c) >= 0 THEN 
LET 1 = root2b(a,b, c , irt) IN 
IF 1 > 0 THEN 
l*vnzo 
ELSE 
zero 
ENDIF 
ELSE 
zero 
ENDIF 


B.3 Track Line Algorithm 

The track line algorithm is defined as follows in PVS: 

sp : VAR Sp_vect2 

u,vnz,vnzo : VAR Nz_vect2 
eps,irt : VAR Sign 
vo,vi,nvo : VAR Vect2 


trk_only_line(vnz, vo, vi , irt) : {k: real , nvo :Vect2 | 

nz_vect2?(nvo) => trk_only? (vo) (nvo) AND 
k*vnz = nvo-vi} = 

LET a = sqv(vnz), 
b = vnz*vi , 

c = sqv(vi) - sqv(vo) IN 
IF discr2b(a,b, c) >= 0 THEN 
LET k = root2b(a,b, c,irt) IN 
(k,k*vnz+vi) 

ELSE 

(0,zero) 

ENDIF 

trk_line_eps_irt (sp,vo, vi,eps,irt) : {nvo:Vect2 | nz_vect2? (nvo) => 

trk_only?(vo) (nvo)} = 

LET (k,nvo) = trk_only_line (tangent_line (sp, eps) , vo , vi , irt) IN 
IF nz_vect2? (nvo) AND k >= 0 THEN 
nvo 
ELSE 
zero 
ENDIF 
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B.4 Track Circle Algorithm 

The track circle algorithm is defined as follows in PVS: 

s,nvo : VAR Vect3 

vo,vi : VAR Nzv2_vect3 

dir, irt : VAR Sign 

t : VAR posreal 

horizontal_dir?(s: Vect2, v: Vect2,eps) : MACRO bool = 
eps*(s*v) >= 0 

vertical_dir?(sz : real,vz: real, eps) : MACRO bool = 
eps*(sz*vz) >= 0 

trk_circle(s, vo, vi ,t , irt ,eps) : {nvo | nz_vect2? (nvo) => 

trk_only?(vo) (nvo)} = 

LET P = s - t*vi, 

e = sqv(P) + sq(t)*sqv(vo) - sq(D) , 
a = 4*sq(t)*sqv(P) , 
b = 4*t*e*P'x, 

c = sq(e) - 4*sq(P'y)*sq(t)*sqv(vo) IN 
IF solvable? (a, b,c) THEN 

LET nvox = solution(a,b, c , irt) , 

sgny = IF sign(-P'y) = sign(e+2*P f x*t*nvox) THEN 1 ELSE -1 ENDIF 
IN 

IF sqv(vo) - sq(nvox) > 0 THEN 

LET nvoy = sgny* sqrt (sqv(vo) -sq (nvox) ) IN 
(nvox,nvoy) 

ELSE 

zero 

ENDIF 

ELSE 

zero r/o zero indicates no solution 
ENDIF 

B.5 Vectors 

The NASA PVS library B1 contains two theories that define 2D vectors and 3D 
vectors, named vectors_2D and vectors_3D. These theories introduce the following 
record types. 


Vect2: 

TYPE = [# 

x, y: real #] 

Vect3: 

TYPE = [# 

x, y, z: real #] 


Given the following variable declarations 

v: VAR Vect2 
w: VAR Vect3 

B1 Available at http://shemesh.larc.nasa.gov/fm/ftp/larc/PVS-library/pvslib.html. 
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the components of the vectors v and w are accessed using a c character: v c x, v‘y, 
w‘x, w‘y, and w‘z. The standard operations on vectors are defined: if u and v 
are vectors and a is a scalar, u + v, -u, u - v, u * v, and a*v denote addition, 
negation, subtraction, dot product, and scalar multiplication, respectively. We also 


define 


sq(v) 

: nnreal = sq(v‘x) + sq(v c y) 

sqv(v) 

: nnreal = v*v 

norm(v) 

: nnreal = sqrt(sq(v)) 


where unreal is the type of non- negative real numbers. The zero vectors are defined 
as follows 

zero: Vect2 = (0, 0) 
zero: Vect3 = (0, 0, 0) 

A vect2D function is provided that creates a 2D vector from a 3D vector by trun- 
cation, i.e., throwing away the z-component: 

vect2D(v:Vect3) : Vect2 = (v‘x,v‘y) 

B.6 Roots 

The quadratic theory in the reals library defines the following functions 
sq(x: real) = x*x 

quadratic (a, b, c: real) (x) : real = a*sq(x) + b*x + c 
discr(a,b,c) : real = sq(b) - 4*a*c 

root (a:nonzero_real ,b:real, c :real I discr (a,b,c)>=0,eps :Sign) :real = 

(-b + eps*sqrt (discr (a,b, c) ))/(2*a) 

discr2b(a,b, c) : real = sq(b) - a*c 

root2b(a:nonzero_real,b:real, c:real I discr2b(a,b, c)>=0,eps : Sign) :real = 

(-b + eps*sqrt (discr2b(a,b,c)))/a 
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Appendix C 


Linear Combination 


A linear combination of sine and cosine is a useful identity used throughout the 
trigonometric proofs. 

Theorem C.l (linear combination). A linear combination of sine and cosine 
can be expressed with a single sine function , such that 

Esin a + Fcos a = \J E 2 + F 2 sin(a + atan^, F)) 

Provided that either E or F is not zero — the arctangent function is undefined in this 
case. The function ata n(E,F) is defined as the arctangent of F/E. 

Proof. The proof involves trigonometric reasoning. We proceed by transforming the 
right side of the equality into the left side. 

\J E 2 + F 2 sin(ct + atan(i£, F )) 

\[e ‘ 2 + F 2 (sin(o;)cos(atan(£', F)) + cos(a)sin(atan(i£, F))) 


Using standard trigonometric identities, 

\/E 2 + F 2 [ sin(a) Slgn ( £ ') 


Fsig n(E) 
+ cos (a)- E 


FFtf 7^(f) 

Then we use algebraic manipulations, 

J E 2 T F 2 ( sin (oQ si g n(-g) + cos(a) Fsi | tl( - E ) 

\A+(f ) 2 


Jffl . F 2 ( si»(a)sie°(-E) + co 5 (a) f51 g 1(E) \ 

Y I y/EZ+F 2 I 

\ sign (E)E ) 


ign(£)£ 

sign(E)E (sin(o')sign(£ l ) + cos(o:) 
Esina + F cos a 


Fsign(E)\ 
E ) 


since, (sign^)) 2 = 1. 


□ 
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